Introducing the Secure Supply Chain Consumption Framework (S2C2F)

on YouTube ↗52m

" summary

Framework named S2C2F is published as a guidebook (version 1.1) and contributed to OpenSSF with a maturity model of four levels and eight practices; Microsoft reports 83,000 unique OSS packages used 11 million times, industry telemetry shows 88,000 malicious packages in 2022 (742% YoY increase) and SaltStack was exploited within three days of a patch. Concrete controls include package mirroring to artifact feeds (Azure Artifacts, JFrog), package source mapping, SBOMs and provenance checks (npm support), automated updates (Dependabot), malware scanning prior to consumption (packj), and reference CI/CD implementations for GitHub and GitLab.

AI-written summary · about

" chapters (20)

1. 0:00Introduction
2. 2:27Problem: Attackers are shifting left
3. 3:11Microsoft is a large consumer of open source
4. 3:41The Journey so far
5. 5:05OpenSSF Security Maturity Frameworks
6. 5:52C2F Guide Available in the Repo
7. 7:16NSA Enduring Security Framework (ESF)
8. 7:55How we model the space
9. 19:311. Ingest-saving a local copy of the package/source
10. 22:24Problem: Myriad of ways that developers consume open source
11. 24:47Recognizing an Insecure Package Source File
12. 27:49Enforce it ENF-1: Secure Package Source File
13. 28:462. Scan for vulnerabilities and malware
14. 30:07ING-4: mirror OSS source to an internal location SCA-5: Perform proactive security reviews
15. 32:50Inventory OSS usage and deployment
16. 37:03Audit
17. 40:03Rebuild on trusted infrastructure
18. 41:23Fix It + Upstream
19. 42:29OpenSSF S2C2F SIG
20. 45:20Apply the S2C2F to your team/organization

" related talks

• 44mNext-Level DevSecOps: Secure Supply Chain Consumption Framework Q&AAdrian Diglio, Jasmine Wang, Richard Diver, Tim Fish, Mikayla Soucie, Mia Jewella Reyes · Microsoft Build 2023
• 40mImproving Supply Chain Integrity with Ope...Arnaud J Le Hors, Michael Lieberman, Marcela Melara, Jay White, Isaac Hepworth · SupplyChainSecurityCon @ Open Source Summit North America 2024
• 32mSoftware Supply Chain SecuritySantiago Torres-Arias, Kay Williams · Continuous Delivery Summit 2019 - San Diego
• 33mWhat is the secure software supply chainPaolo Mainardi · phpday 2024
• 38mSecuring the chains: Building defensive layers for software supply chainsHritik Vijay, Akhil Mahendra, Yadhu Krishna M · Nullcon Goa 2025
• 41mSupply Chain Armoring: Tools and Techniques for Open Source ProjectsDavid C Stewart · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...Tracy Ragan · Open Source Summit North America 2025
• 30mSupply Chain Security for OpenSource ProjectsSven Ruppert · Conf42 Cloud Native 2023